Discovered by malware analyst Karsten Hahn, TomyBank is a ransomware-type program. It is designed to encrypt data and demand ransoms for the decryption. We obtained a sample of TomyBank from VirusTotal and launched it onto our test machine. This ransomware began encrypting data and displayed a fa
DynamicInterface is the name of a rogue application that our research team found while inspecting new submissions to VirusTotal. After analyzing this app, we discovered that DynamicInterface operates as advertising-supported software (adware) and belongs to the AdLoad malware family. If
SHILED (SHIELD) is the name of a ransomware-type program that we discovered while looking through new malware submissions on VirusTotal. Typically, malicious programs within this category encrypt data to demand ransoms for the decryption. After analyzing SHILED (SHIELD), we determined that it enc
We have discovered the ExecutiveBrowser application on a shady website offering to download an update for the Adobe Flash Player. After testing the app, we found that it generates advertisements - it functions as adware. Ads displayed by adware downloaded from untrustworthy sources cannot be tru
Mund35ane-cha11nnel[.]xyz is an untrustworthy website that runs the "McAfee - Your PC is infected with 5 viruses!" scam and asks for permission to show deceptive notifications. We have discovered it while visiting pages (illegal movie streaming sites, pages offering to download videos from YouTube
While inspecting shady sites, our researchers discovered the youzik[.]app website. It operates as a YouTube converter/downloader, i.e., this site allows users to convert video links from this platform into downloadable audio files (MP3 format). Not only does this service break copyright laws, but
Listentoyou[.]tube is a website offering to download music from YouTube in MP3 format. However, it uses rogue advertising networks - it opens various questionable (potentially malicious) pages. It is worth mentioning that pages using the networks mentioned above can display shady advertisements.
During a routine inspection of new submissions to VirusTotal, our research team found the CommonOperation application. Following our analysis, we determined that this piece of software operates as adware and belongs to the AdLoad malware family. Adware may require certain conditions (e.g
SMSControllo is the name of an Android malware targeting residents of Italy. This malware can steal SMS messages (read and send them to a server controlled by the attackers) and share the infected device's screen. It is likely that threat actors use email attachments or SMS to deliver SMSControllo
Ygvb is a piece of malicious software classified as ransomware. Our researchers found this program while inspecting new submissions to VirusTotal, and determined that it belongs to the Djvu ransomware family. After being launched onto our test machine, Ygvb encrypted files and appended their file